1
vote
1answer
402 views

Is it safe to use flex and bison as a protocol parser?

I started writing a a simple protocol lexer and parser for STOMP using flex and bison. Does anyone know of any security issues that might result from this? Edit: Added code. %{ /* Tokenizer for ...
0
votes
1answer
504 views

Does S/MIME provide means to propagate a certificate's revocation?

Can a revocation certificate for an old X.509 certificate be attached to an email in addition to a replacement certificate in such a way that the client user does not have to manually intervene? Or ...
2
votes
3answers
283 views

What is required to ensure users' information being sent over my website is secure with the use of account log ins

I have inherited the responsibility of managing my company's website. There are some customers who are required to submit highly confidential information via the website using online forms. I have ...
2
votes
1answer
357 views

Credit card data - sharing and storage [duplicate]

What is the industry standard for sharing credit card data between client (thin & thick) and server?
0
votes
2answers
900 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
6
votes
1answer
1k views

Prevent cross domain form submission with nonce?

I haven't done much in web security before but am now in need to prevent a form from being submitted from anything but my own domain. I know how to lock this down in an .htaccess file but the ...
4
votes
2answers
177 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
2
votes
1answer
1k views

How to filter https traffic in mod-security WAF?

I'm developing a WAF with good GUI and better log. And my base firewall is mod-security. It works well for http but I also want to work my WAF with https. Any suggestions?
2
votes
0answers
239 views

Utility to hide several encrypted messages in single file [closed]

I am interested, are there existing utilities/projects under way devoted to combining encryption and steganography. I would like to - combine two or more messages, encrypted with separate ...
-1
votes
3answers
197 views

Secure transmission for desktop applications

Suppose I have a desktop application that does password hashing for login authentication. Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
2
votes
2answers
669 views

Which is better for SSL: TLS_EDH or TLS_SRP?

DH is vulnerable to a man-in-middle attack due to no server authentication; and RSA does not have forward secrecy. People suggest used Ephemeral DH but what are the differences between Ephemeral DH ...
3
votes
4answers
725 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
4
votes
4answers
805 views

Insecure to require numbers in passwords?

Earlier, I went to a site that required a number and special character, and it got me thinking – wouldn't that make the password easier to brute force? If you assume most passwords have around 12 ...
3
votes
2answers
253 views

How to red team against firewalled architecture?

Prior Knowledge I understand the types and differences between firewalls. I have (what I believe to be) a relatively good mental model of a firewall. I understand routing, iptables, signature ...
9
votes
1answer
2k views

NOPS in Metasploit

Problem I do not know what a "NOP" is in Metasploit Framework or otherwise. What I do know Metasploit Unleashed says, "Nops keep the payload sizes consistent." A few question posts mention buffer ...
2
votes
4answers
2k views

Why do I need both root password and user password in Fedora Linux?

I am just now installing (for the first time) a shiny new Fedora 18. I set up a strong root password, installed the whole thing. Now it is asking me to create a user account and a password is ...
1
vote
2answers
332 views

Creating a rainbow table with predefined text

I need to extract a password from a hash. This hash was generated by prepending and appending two different predefined strings to the password: Hash(PredefinedString1+Password+PredefinedString2) ...
6
votes
5answers
2k views

Does a binary executable have to have some critical plain-text components?

When companies package binary executables, they are often encrypted, compressed, scrambled, and otherwise made so that your lazy hacker can't simply open the program up in Notepad++ and see the code. ...
1
vote
4answers
1k views

Our logs showing a lot of SSH brute force attacks originating on Port 11

this forum has been brilliant so far. Just wondering if I can get a bit more help: Can I get some info on a large amount of SSH brute force attacks originating from port 11 on the external host over ...
5
votes
1answer
178 views

Hidden directory with 0x0d0x0a

Someone has hidden a directory to fool policies on a FTP account. The directory name was 0x0d0x0a. How did the user create a folder with that name? The directory is nearly invisible with ls but ...
2
votes
2answers
702 views

What is this hashing algorithm?

I need to authenticate against another programs user credentials to allow access to a second tie-in system. I am having trouble figuring out what hashing algorithm is being used by the first program ...
1
vote
3answers
177 views

Central authentication

I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service. My ...
2
votes
2answers
270 views

Slow down symetric encryption

I'm developing a program in Java. In one step data should be encrypted and exported in a file. As of now we are encrypting in AES-256 I want to slow down a possible brute force attack as much as ...
-3
votes
2answers
613 views

Cannot use HTTPS or download stuff from sourceforge with a mac, what kind of soft does that? [closed]

I'm at a public library (france). I have a http library login to access that wifi. I just want to download some SFML zip to make some app, but many things are blocked, mainly https. I can't even ...
4
votes
2answers
3k views

gpg --perfect-code

By default gpg use CAST5 with SHA1 (not so good) as it had AES256 and hash512! Now I want to use the perfect code to encrypt my files for both symmetric & asymmetric For symmetric encryption I ...
3
votes
2answers
4k views

Ssl certificate rekey or revoke

I want to be sure to understand well the situation where SSL certificate is compromised. If I ask for a rekey, I suppose the old certificate will remain valid. The future communications with the new ...
4
votes
1answer
378 views

Saved passwords (use case)

I have a program in which a user enters a password, and the user data is stored encrypted using AES-128. The data and passwords must be stored together. Both the data and the password are encrypted ...
4
votes
2answers
250 views

Options for simple phone verification with pin delivery

My website needs to verify phone numbers in order to ensure that customers claiming a business actually work there. The service calls and gives the customer a pin which they put into the site. Many ...
2
votes
2answers
844 views

keylogger detection by listening network

It is known that malware often uses keyloggers. Also some viruses aren't detected by antiviruses, therefore some viruses, especially APTs could stay in a system for so long without any detection. What ...
2
votes
2answers
2k views

Minimum size of input text box required for XSS attacks

I have below code to accept User login ID as input from User. <input name="userName" type="text" id="userID" maxlength="8"/></td> Maximum number of characters that a end user can input ...
3
votes
1answer
94 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
86
votes
7answers
5k views

How do I know a piece of software only does what the author claims?

Without being a programmer or a computer expert, how can I know if a particular program or any piece of software in general doesn't have hidden unwanted functions compromising privacy and security?
21
votes
6answers
2k views

Why are vulnerabilities and lack of security possible in computers?

I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why doesn't the computer just do the things it is supposed to? Why do some people write malware, ...
1
vote
1answer
340 views

What are the basic implementations that make a network secure from the inside\outside?

Would you consider the following to be "basic hardening items" for network equipment and servers? VLANs Access Control (such as NTFS permissions) Patch Management System Host Firewall Anti-Virus ...
31
votes
4answers
40k views

Should SSL be terminated at a load balancer?

When hosting a cluster of web application servers it’s common to have a reverse proxy (HAProxy, Nginx, F5, etc.) in between the cluster and the public internet to load balance traffic among app ...
2
votes
2answers
2k views

Retreive header from SMS iphone

I received a lot of SMS from a guy where the phone number change every time. I can answer to these SMS, so I think it's only a spoofing of the sender ID of the SMS header which will be displayed in ...
2
votes
1answer
208 views

Windows App Store security

It seems like most companies now a days, give you a crappy laptop with some version of Windows on it that allows you to access the internet (sometimes they block YouTube, Facebook, etc.), comes with ...
18
votes
2answers
12k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
0
votes
3answers
164 views

Secure design for handling mail attachments

I'm fan of split design for web browsing for security reasons - trusted web sites can be accessed via http proxy from pc clients, the rest of web sites via some remote desktop technology from specific ...
2
votes
3answers
577 views

Are intermediate signing certs the only secure+practical way to manage OpenVPN client certs?

My organization needs to issue (and revoke) OpenVPN client certificates for people working remotely. Our system is based on a standard OpenSSL CA setup and the easy-rsa tools, and the whole directory ...
-6
votes
1answer
585 views

Secure Web application Password vault/manager [duplicate]

I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a ...
5
votes
1answer
446 views

Apart from the lack of native Oultook support, why should one prefer S/MIME over PGP/MIME for email?

From my (still quite subjective) point of view, GnuPG/PGP is superior to SSL (or more specifically, PGP/MIME over S/MIME; maybe in other areas SSL is the better choice), e.g. due to the support of ...
4
votes
2answers
3k views

JavaScript eval() to parse JSON after sanitizing with regexes — is XSS possible?

Is possible to bypass my regex and execute any JavaScript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
38
votes
2answers
8k views

How do antiviruses scan for thousands of malware signatures in a short time?

Most antiviruses have hundreds of thousands or even millions of malware signatures and yet they scan many files in a reasonable short time with high detection rates. Even real-time scanners doesn't ...
8
votes
2answers
2k views

What unique risks does MVC model binding bring to a website? What additional vigilance is needed?

From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
7
votes
3answers
4k views

Is decompiling software considered unethical or illegal?

Is decompiling a dynamic link library considered unethical/illegal or blackhat? If, for instance, the result of the decompile showed methods and literals that contain passwords that the application ...
7
votes
6answers
2k views

how to mitigate a DDoS from botnet on your website that comes from random IPs

I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website. If there was a consistent URL it was hitting then it would be fairly simple, and ...
1
vote
2answers
9k views

Why does OpenSSL not include AES-256-GCM? [closed]

I'm trying to implement AES-256-GCM in Ruby. Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this. However, neither 0.9.8r (which I had ...
2
votes
5answers
477 views

Safer way to access paypal, Mobile or Pc?

I often find it difficult to chose if it is safer (in any context) to log in to my paypal, or other similar banking accounts using my Nokia or my PC. Maybe, I am assuming the fact, that since I do ...
2
votes
3answers
967 views

Using RADIUS for host authentication

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a ...

15 30 50 per page